Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- How hackers extorted $1.14m from University of California, San Francisco
- Yahoo engineer gets no jail time after hacking 6,000 accounts to look for porn
- Citizen of Kazakhstan, known as “fxmsp,” charged with computer fraud
- FSB’s Magnificent Seven: New links between Berlin and Istanbul assassinations
- With India’s TikTok ban, the world’s digital walls grow higher
- Anonymous hackers target TikTok: ‘Delete this Chinese spyware now’
- China’s Great Firewall has finally come to Hong Kong’s internet
- Hong Kong downloads of Signal surge as residents fear crackdown
- WhatsApp stops processing police requests for Hong Kong users’ data amid protests
- Facebook admits to improperly giving user data to third-party developers, again
- Cybersecurity experts take aim at senators over encryption
For the more technical
- Would you like some RCE with your Guacamole?
- Citrix fixes 11 flaws in ADC, Gateway, and SD-WAN WANOP appliances
- System hardening in Android 11
- Android Security Bulletin—July 2020
- Another macOS privacy protections bypass
- How to unc0ver a 0-day in 4 hours or less
- ZombieVPN, breaking that internet security
- Microsoft releases emergency Windows 10 updates to resolve security flaws
- Hijacking DLLs in Windows
- Bring your own .NET Core Garbage Collector
- Screwed drivers open ATMs to attack
- F5 BIG-IP remote code execution exploit – CVE-2020-5902
- CVE-2020-2021 PAN-OS: Authentication bypass in SAML authentication
- A hacker gang is wiping Lenovo NAS devices and asking for ransoms
- Remote code execution vulnerability in Zoom client for Windows (0day)
- Hacker ransoms 23k MongoDB databases and threatens to contact GDPR authorities
- Web skimmer hides within EXIF metadata, exfiltrates credit cards via image files
- Domains visited get leaked to DDG servers
- CanaryTrap: Detecting data misuse by third-party apps on online social networks (PDF)
- They steal your Facebook
- New Joker variant hits Google Play with an old trick
- Pig in a poke: smartphone adware
- New ransomware posing as COVID‑19 tracing app targets Canada
- Business giant Xerox allegedly suffers Maze ransomware attack
- Electric company ransomware attack calls for $14 million in ransom
- EKANS ransomware targeting OT ICS systems
- The Snake attacks holding the industrial sector ransom
- New Mac ransomware spreading through piracy
- OSX.EvilQuest uncovered
- Mac ThiefQuest malware may not be ransomware after all
- Breaking EvilQuest – Reversing a custom macOS ransomware file encryption routine
- Mozilla suspends Firefox Send service while it addresses malware abuse
- GoldenSpy: Chapter two – The uninstaller
- Mobile APT surveillance campaigns targeting Uyghurs (PDF)
- Microcin is here – With asynchronous sockets, steganography, GitLab ban and a sock
- More evil: A deep look at Evilnum and its toolset
- North Korean hackers are skimming US and European shoppers
- “Keeper” Magecart group infects 570 sites
- Cosmic Lynx: A russian threat hits the BEC scene
- PROMETHIUM extends global reach with StrongPity3 APT
- StrongPity APT – Revealing trojanized tools, working hours and infrastructure (PDF)
- Microsoft takes legal action against COVID-19-related cybercrime
- Remote access at risk: Pandemic pulls more cyber‑crooks into the brute‑forcing game
- PWDB – New generation of Password Mass-Analysis
- The 15 billion stolen credentials allowing account takeover (PDF)
- Dark Web Price Index 2020
- Redirect auction
- Configuring IPsec Virtual Private Networks (PDF)
- Google open-sources Tsunami vulnerability scanner + more information
- Introducing project Freta
- New Behave! extension warns of website port scans, local attacks
- Apple declined to implement 16 Web APIs in Safari due to privacy concerns
- Security cameras can tell burglars when you’re not home, study shows (PDF)
- Unlocking BitLocker: Can you break that password?
- Disrupting deepfakes: Adversarial attacks on conditional image translation networks
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.